The Arcive of Official vBulletin Modifications Site.It is not a VB3 engine, just a parsed copy! |
|
#1
|
|||
|
|||
vb eval() -- huh?
I'm currently going through the source code of vB 2.3.0, and I'm confused by all the eval'ed statements I'm finding (especially in functions.php). Example:
eval("\$customfields .= \"".gettemplate("getinfo_customfields")."\";"); This seems not only unneccesary, but dangerous. There's too much trust being placed upon the gettemplate function and the table data it pulls it's results from. Is there any benefit to doing this which perhaps I've missed? |
#2
|
|||
|
|||
It allows you to use variables in templates.
|
#3
|
||||
|
||||
nothing is dangerous, because the templates are just saved in strings and not parsed directly (except phpinclude)
how eval works can be seen in php.net function list |
#4
|
|||
|
|||
Filburt, excuse my continued confusion, but how is:
PHP Code:
PHP Code:
PHP Code:
PHP Code:
I see the risk here, but not the benefit. |
#5
|
|||
|
|||
|
#6
|
||||
|
||||
@loOL:
look at the code more exactly. if gettemplate returns -- "; system("blah"); it will end up in this: $bla = " ---\"; system(\"blah\"); "; there's addslashed in gettemplate, just if you don't want em in you can call gettemplate in another way.. |
#7
|
|||
|
|||
Quote:
Thanks for the help. |
#8
|
|||
|
|||
Quote:
You may be rewriting half of vBulletin then because there are at least two "special" templates that I can think of that do not work like normal templates. |
#9
|
||||
|
||||
phpinclude, options, birthdays, and maxloggedin.
I think those are the 4 templates that aren't normal templates. |
#10
|
||||
|
||||
just phpinclude and options count, because these are really evaled
the other two, are also somehow special, but in another way |
|
|
X vBulletin 3.8.12 by vBS Debug Information | |
---|---|
|
|
More Information | |
Template Usage:
Phrase Groups Available:
|
Included Files:
Hooks Called:
|